It seems like what's happening is the cloudwatch log group I define is being created and from the pulumi output it looks like it's a dependency of the lambda created from the

callbackFunction

call. However, when the lambda is actually deployed, a default cloudwatch log group is being used instead. This one is not tracked in the stack and cannot be destroyed using pulumi. Not sure if i'm maybe just missing some config somewhere, but this behavior seems odd.

nvm resolved. Didn't realize for lambdas the function name has to match the cloudwatch name and that you couldn't assign a custom one with a different name.